Protections
- WAF shields — SQL injection, XSS, remote file inclusion, and directory traversal.
- Security headers — X-Frame-Options, CSP, HSTS, Referrer-Policy, Permissions-Policy.
- IP management — trusted IPs, a blocklist, and auto-ban when the WAF threshold is exceeded.
- Password policy — enforce length, uppercase, number, and special-character rules.
- Access control — admin secret URL, frontend super-user block, and upload restrictions.
How It Protects Your Site
These controls work together to reduce the most common ways sites are attacked: the WAF filters malicious requests before they reach Joomla, security headers harden how browsers treat your pages, and access controls limit who can reach sensitive areas.
Getting Started Safely
- Add your own IP to the trusted list before tightening rules, so you don't lock yourself out.
- Introduce stricter settings gradually and watch for false positives on legitimate traffic.
- Keep a record of your admin secret URL in a secure place.
Need Help?
For help tuning the firewall for your site, contact the Moko Consulting team at